Changes to migrate to new TUF repository #1948
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build, Sign and Notarize Orbit for macOS | |
| on: | |
| workflow_dispatch: # allow manual action | |
| push: | |
| paths: | |
| # The workflow can be triggered by modifying ORBIT_VERSION env. | |
| - '.github/workflows/build-orbit.yaml' | |
| pull_request: | |
| paths: | |
| - 'orbit/**.go' | |
| # The workflow can be triggered by modifying ORBIT_VERSION env. | |
| - '.github/workflows/build-orbit.yaml' | |
| env: | |
| ORBIT_VERSION: 1.20.0 | |
| CGO_ENABLED: 1 | |
| # This allows a subsequently queued workflow run to interrupt previous runs | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference | |
| shell: bash | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 | |
| - name: Import signing keys | |
| env: | |
| APPLE_APPLICATION_CERTIFICATE: ${{ secrets.APPLE_APPLICATION_CERTIFICATE }} | |
| APPLE_APPLICATION_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_APPLICATION_CERTIFICATE_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| echo "$APPLE_APPLICATION_CERTIFICATE" | base64 --decode > certificate.p12 | |
| security create-keychain -p $KEYCHAIN_PASSWORD build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain | |
| security import certificate.p12 -k build.keychain -P $APPLE_APPLICATION_CERTIFICATE_PASSWORD -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain | |
| security find-identity -vv | |
| rm certificate.p12 | |
| - name: Set up Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Build, codesign and notarize orbit | |
| run: go run ./orbit/tools/build/build.go | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }} | |
| AC_USERNAME: ${{ secrets.APPLE_USERNAME }} | |
| AC_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| AC_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CODESIGN_IDENTITY: 51049B247B25B3119FAE7E9C0CC4375A43E47237 | |
| ORBIT_VERSION: ${{ env.ORBIT_VERSION }} | |
| ORBIT_COMMIT: ${{ github.sha }} | |
| - name: Upload orbit | |
| uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2 | |
| with: | |
| name: orbit | |
| path: | | |
| orbit-darwin |